Скачать или смотреть Munich Embedded 2025: Reproducibility in Open Source Firmware - Josef Holzmayr

Lightning Talk at Munich Embedded 2025

Josef Holzmayr (https://northern.tech/)
Josef has been active for more than 15 years as a "Complete"-Stack developer for industrial controls by now. He's done everything from debugging hardware to writing drivers, from application development to web front ends. A passion for showing, telling, and teaching people in both entertaining and engaging ways led Josef to Mender.io. Here, he tries to make the world better and more secure by enabling OTA updates for as many devices as possible. Josef has been awarded Ambassador status and is serving as Community Manager for the Yocto Project.

Abstract
Reproducible builds are becoming essential for firmware security as supply chain attacks target embedded systems. This session demonstrates practical reproducible build implementations in the Yocto Project and Zephyr RTOS, showing how to achieve bit-for-bit identical firmware builds in production environments. The Yocto Project has achieved 100% reproducibility for OpenEmbedded-Core using SOURCE_DATE_EPOCH and deterministic build processes. Zephyr RTOS provides reproducible builds for MCU firmware, addressing unique challenges in resource-constrained environments. Both projects prove that deterministic firmware builds are achievable at scale.

We will look at CI/CD integration patterns, and how they might complement or contradict reproducibility. The presentation demonstrates some common errors that break reproducibility, including timestamp variations, non-deterministic file ordering, build path dependencies, and environment-specific configurations, providing practical solutions for each challenge.

Find the slides at https://github.com/munich-embedded/co...

Learn more about Munich Embedded:
https://www.munich-embedded.com/